ANSPDCP (Romania) - Fine against IAMSAT Muntenia SA: Difference between revisions
From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Romania |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoRO.jpg |DPA_Abbrevation=ANSPDCP (Romania) |DPA_With_Country=ANSPDCP (Romania) |Ca...") |
mNo edit summary |
||
| Line 55: | Line 55: | ||
}} | }} | ||
A controller was fined | A controller was fined EUR 1000 for not answering an object request and EUR 2000 for not informing its employees about the video surveillance systems installed at the workplace. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
A data subject, ex-employee of a controller, made an object request, asking the controller to stop processing their personal data considering they did not have anymore an ongoing contractual relationship. The controller did not solve nor reply to the data subject's request before the legal deadline, in breach of GDPR Article 12(3) and 21. | A data subject, ex-employee of a controller, made an object request, asking the controller to stop processing their personal data, considering they did not have anymore an ongoing contractual relationship. The controller did not solve nor reply to the data subject's request before the legal deadline, in breach of GDPR Article 12(3) and 21. | ||
As such, the data subject filed a complaint with the Romanian DPA. | As such, the data subject filed a complaint with the Romanian DPA. | ||
During the investigation, besides the facts concerning the data subject's right request, the authority found that the controller was conducting video surveillance at its workplace and therefore processing personal data, without | During the investigation, besides the facts concerning the data subject's right request, the authority found that the controller was conducting video surveillance at its workplace and therefore processing personal data, without prior information of the employees (data subjects). | ||
=== Holding === | === Holding === | ||
The controller was found in breach of: | The controller was found in breach of: | ||
Additionally, the controller was requested to comply with the following corrective measures: | * GDPR Articles 12(3) and 21 for not handling the data subject right request and fined approximately EUR 1000 (RON 4.946,2); | ||
* GDPR Articles 12-13 for not informing data subjects on the processing of personal data through video surveillance at the workplace and fined approximately EUR 2000 (RON 9.892,4). | |||
Additionally, the controller was requested to comply with the following corrective measures: | |||
* to inform the data subjects and particularly its employees on the data processing activities conducted through video surveillance; | |||
* to reply to the data subject and to solve their request accordingly. | |||
== Comment == | == Comment == | ||
Revision as of 08:50, 1 March 2022
| ANSPDCP (Romania) - Fine against IAMSAT Muntenia SA | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 12 GDPR Article 12(3) GDPR Article 13 GDPR Article 21 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 22.02.2022 |
| Fine: | 3000 EUR |
| Parties: | IAMSAT Muntenia SA |
| National Case Number/Name: | Fine against IAMSAT Muntenia SA |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (in RO) |
| Initial Contributor: | Diana Rosu |
A controller was fined EUR 1000 for not answering an object request and EUR 2000 for not informing its employees about the video surveillance systems installed at the workplace.
English Summary
Facts
A data subject, ex-employee of a controller, made an object request, asking the controller to stop processing their personal data, considering they did not have anymore an ongoing contractual relationship. The controller did not solve nor reply to the data subject's request before the legal deadline, in breach of GDPR Article 12(3) and 21.
As such, the data subject filed a complaint with the Romanian DPA.
During the investigation, besides the facts concerning the data subject's right request, the authority found that the controller was conducting video surveillance at its workplace and therefore processing personal data, without prior information of the employees (data subjects).
Holding
The controller was found in breach of:
- GDPR Articles 12(3) and 21 for not handling the data subject right request and fined approximately EUR 1000 (RON 4.946,2);
- GDPR Articles 12-13 for not informing data subjects on the processing of personal data through video surveillance at the workplace and fined approximately EUR 2000 (RON 9.892,4).
Additionally, the controller was requested to comply with the following corrective measures:
- to inform the data subjects and particularly its employees on the data processing activities conducted through video surveillance;
- to reply to the data subject and to solve their request accordingly.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
22.02.2022 Sanction for violating the RGPD In February 2022, the National Supervisory Authority completed an investigation at the IAMSAT Muntenia SA operator and found a violation of the provisions of art. 12, art. 13 and art. 21 of the General Data Protection Regulation. The operator was sanctioned for minor offenses, as follows: fine in the amount of 9,892.4 lei, the equivalent of 2,000 euros for violating the provisions of art. 12-13 of the General Regulation on Data Protection; fine in the amount of 4,946.2 lei, the equivalent of 1,000 euros for violating the provisions of 12 para. (3) and art. 21 of the General Data Protection Regulation. The investigation was initiated following a complaint lodged by a data subject who complained that IAMSAT Muntenia SA continued to process his personal data after the termination of his employment contract in 2020. By a request, this person informed the operator that he / she does not consent to the use of his / her e-mail address and that he / she opposes the processing of his / her personal data by IAMSAT Muntenia SA and / or third parties, natural or legal, after the termination of the employment contract. During the investigation, it was noted that IAMSAT Muntenia SA did not present evidence regarding the prior and complete information of its employees, including the data subject, before starting the processing of personal data of these persons by means of video surveillance installed in their place. of work, put into operation from the middle of 2020, although the operator had the obligation to inform the employees according to art. 12-13 of the General Regulation on Data Protection. At the same time, it was noted that IAMSAT Muntenia SA did not resolve the request of the data subject and did not communicate a response regarding the measures adopted following the exercise of the right of opposition within the legal deadlines, in accordance with the provisions of art. 12 para. (3), reported to art. 21 of the General Data Protection Regulation. At the same time, two corrective measures were applied to the operator's investigation, as follows: corrective action to ensure compliance with the General Data Protection Regulation of personal data processing operations, by providing full information to data subjects, in particular employees of the controller, on the use of the video surveillance system, in relation to the obligations of art. 12-13 of the General Regulation on Data Protection; the corrective measure to send a response to the person concerned to his request, including the measures adopted following the exercise of the right of opposition, by reference to the provisions of art. 12 and 21 of the General Data Protection Regulation. Legal and Communication Department A.N.S.P.D.C.P.
